The README.md file suggests:
If you're the kind of shoot-from-the-hip brogrammer that doesn't mind
executing random scripts from the interwebs, then the easiest way to
install Emacs Live is to run the following which will safely preserve
any Emacs configs you already have:
bash <(curl -fksSL https://raw.github.com/overtone/emacs-live/master/installer/install-emacs-live.sh)
I understand why you might want to use curl and bash together, even though I don't agree with it. The part that I take issue with, however, is the use of the -k switch, which turns off certificate validation, so that even a certificate error will still cause it to succeed. This change was made in c4ca545, but I can't see a justification for it.
May I ask why this change was made? It negates one of the biggest points of using SSL in the first place and makes a MITM attack ridiculously easy. If someone has outdated certificates then they should be updating those first.
The README.md file suggests:
I understand why you might want to use curl and bash together, even though I don't agree with it. The part that I take issue with, however, is the use of the
-kswitch, which turns off certificate validation, so that even a certificate error will still cause it to succeed. This change was made in c4ca545, but I can't see a justification for it.May I ask why this change was made? It negates one of the biggest points of using SSL in the first place and makes a MITM attack ridiculously easy. If someone has outdated certificates then they should be updating those first.